docs: expand development guidelines and security documentation

README.md

@@ -62,6 +62,12 @@ Or specify options directly (overrides config):
 
 Access with a Gemini client like Lagrange at `gemini://yourdomain.com/`.
 
+### Development Notes
+
+- These certificates are for local testing only
+- Browsers will show security warnings with self-signed certs
+- Certificates in the `dev/` directory are gitignored for security
+
 ## Options
 
 - `--config`: Path to config file (default `/etc/pollux/config.toml`)